HackerReposA FIELD GUIDE TO OPEN SOURCE
ProSponsor the shelf♧ 0
← Back to top all-time
TecharoHQ
anubis
Go2025–2026
TecharoHQ / anubis

anubis

Weighs the soul of incoming HTTP requests to stop AI crawlers

67Distinct people
80Mentions
1Explicit recommenders
24.1KGitHub stars
REPOSITORY AT A GLANCE

What to know before exploring

What it is

Weighs the soul of incoming HTTP requests to stop AI crawlers

GitHub

Where it is used

The last source check was inconclusive. This does not establish whether a product uses it.

What people are saying

This is just like security; the most secure system is the one that nobody can use. I think the proof-of-work approach that anubis[0] takes is pretty interesting. I love the…

wolttam used a recommendation phrase. One indexed comment matches. This is a phrase match, not a verdict.

No classified warning is attached to this page. Read the discussions before treating silence as approval.

Also in these discussions

No other repository is repeatedly linked in the same discussions.

This week on Hacker News

Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 3:56:07 PM UTC.

No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.

Mentions over time

HN mentions by month80 dated mentions

Observed mentions: 2025-03-18 05:45:12 UTC to 2026-10-18 18:22:03 UTC.

051015202025-03-01 00:00:00 UTC to 2025-04-01 00:00:00 UTC (exclusive): 12 mentions; 3 submissions, 9 commentsMar 20252025-04-01 00:00:00 UTC to 2025-05-01 00:00:00 UTC (exclusive): 6 mentions; 0 submissions, 6 comments2025-05-01 00:00:00 UTC to 2025-06-01 00:00:00 UTC (exclusive): 5 mentions; 0 submissions, 5 comments2025-06-01 00:00:00 UTC to 2025-07-01 00:00:00 UTC (exclusive): 2 mentions; 1 submissions, 1 comments2025-07-01 00:00:00 UTC to 2025-08-01 00:00:00 UTC (exclusive): 4 mentions; 1 submissions, 3 comments2025-08-01 00:00:00 UTC to 2025-09-01 00:00:00 UTC (exclusive): 20 mentions; 1 submissions, 19 comments2025-09-01 00:00:00 UTC to 2025-10-01 00:00:00 UTC (exclusive): 1 mentions; 0 submissions, 1 comments2025-10-01 00:00:00 UTC to 2025-11-01 00:00:00 UTC (exclusive): 1 mentions; 0 submissions, 1 comments2025-11-01 00:00:00 UTC to 2025-12-01 00:00:00 UTC (exclusive): 5 mentions; 0 submissions, 5 comments2025-12-01 00:00:00 UTC to 2026-01-01 00:00:00 UTC (exclusive): 4 mentions; 0 submissions, 4 commentsDec 20252026-01-01 00:00:00 UTC to 2026-02-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2026-02-01 00:00:00 UTC to 2026-03-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2026-03-01 00:00:00 UTC to 2026-04-01 00:00:00 UTC (exclusive): 1 mentions; 0 submissions, 1 comments2026-04-01 00:00:00 UTC to 2026-05-01 00:00:00 UTC (exclusive): 2 mentions; 1 submissions, 1 comments2026-05-01 00:00:00 UTC to 2026-06-01 00:00:00 UTC (exclusive): 2 mentions; 0 submissions, 2 comments2026-06-01 00:00:00 UTC to 2026-07-01 00:00:00 UTC (exclusive): 4 mentions; 0 submissions, 4 comments2026-07-01 00:00:00 UTC to 2026-08-01 00:00:00 UTC (exclusive): 3 mentions; 0 submissions, 3 comments2026-08-01 00:00:00 UTC to 2026-09-01 00:00:00 UTC (exclusive): 4 mentions; 0 submissions, 4 comments2026-09-01 00:00:00 UTC to 2026-10-01 00:00:00 UTC (exclusive): 1 mentions; 0 submissions, 1 comments2026-10-01 00:00:00 UTC to 2026-11-01 00:00:00 UTC (exclusive): 3 mentions; 0 submissions, 3 commentsOct 2026

Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.

View mention counts and date ranges
UTC ranges include their start and exclude their end. Select a period to filter the source evidence.
PeriodStart (UTC)End (exclusive, UTC)MentionsSubmissionsComments
Mar 20252025-03-01 00:00:00 UTC2025-04-01 00:00:00 UTC1239
Apr 20252025-04-01 00:00:00 UTC2025-05-01 00:00:00 UTC606
May 20252025-05-01 00:00:00 UTC2025-06-01 00:00:00 UTC505
Jun 20252025-06-01 00:00:00 UTC2025-07-01 00:00:00 UTC211
Jul 20252025-07-01 00:00:00 UTC2025-08-01 00:00:00 UTC413
Aug 20252025-08-01 00:00:00 UTC2025-09-01 00:00:00 UTC20119
Sep 20252025-09-01 00:00:00 UTC2025-10-01 00:00:00 UTC101
Oct 20252025-10-01 00:00:00 UTC2025-11-01 00:00:00 UTC101
Nov 20252025-11-01 00:00:00 UTC2025-12-01 00:00:00 UTC505
Dec 20252025-12-01 00:00:00 UTC2026-01-01 00:00:00 UTC404
Jan 20262026-01-01 00:00:00 UTC2026-02-01 00:00:00 UTC000
Feb 20262026-02-01 00:00:00 UTC2026-03-01 00:00:00 UTC000
Mar 20262026-03-01 00:00:00 UTC2026-04-01 00:00:00 UTC101
Apr 20262026-04-01 00:00:00 UTC2026-05-01 00:00:00 UTC211
May 20262026-05-01 00:00:00 UTC2026-06-01 00:00:00 UTC202
Jun 20262026-06-01 00:00:00 UTC2026-07-01 00:00:00 UTC404
Jul 20262026-07-01 00:00:00 UTC2026-08-01 00:00:00 UTC303
Aug 20262026-08-01 00:00:00 UTC2026-09-01 00:00:00 UTC404
Sep 20262026-09-01 00:00:00 UTC2026-10-01 00:00:00 UTC101
Oct 20262026-10-01 00:00:00 UTC2026-11-01 00:00:00 UTC303

What Hacker News says

80 sources
That doesn't match my experience. For example, I recently had Meta scrape robots.txt disallowed paths. On some page they claimed they respect it but they don't. And yes, all the IPs they used to connect to me (they used a different /64 network for each connection) were owned by Meta, it was not someone pretending to be them. Some other reports of this: https://github.com/TecharoHQ/anubis/issues/1565 I ended up just fully closing connections with no response from these assholes on any URL.
In Web Search API
Nice analogy, wonderful art. Something I've found interesting is that LLMs tend to act like this on the small scale, too. Claude Code in particular appears to be absolutely relentless in trying to come up with workarounds when faced with a block page.[1] As an experiment, a developer for Anubis recently added a feature to give the LLMs an "easier" problem to solve instead of straight-up blocking them, and it seemed quite effective.[2] (It was later removed[3] due to what I assume to be privacy concerns.) I think, beyond HuggingFace, there ought to be a push to align LLMs so they understand that they should not proceed when access is blocked and/or their presence is unwanted. [1]: https://blog.xkeeper.net/the-cutting-room-floor/self-hosting... [2]: https://github.com/TecharoHQ/anubis/pull/1895/commits/de2312... [3]: https://github.com/Tech
Read the rest
In Frog and Toad and the Increasingly Capable Machines
Forgot about that. I intially thought you were referring to CloudFlare Captcha's, which Google and Firefox are partnering with: https://www.techtimes.com/articles/318891/20260623/cloudflar... It's remarkable how much more time one has to wait just to access the same level of information (Cookie Policy, EULAs, etc). Even with "lighter" weight HTTP Firewall utilities such as Anubis (https://github.com/techaroHQ/anubis), the average user has to pay for other's (DDoSers) misdeeds. Now no one can visit a site without a firewall unless it's static and rate-limited by IP address to avoid crashing a small home server. Some impressive LMDBs might be able to serve up to 100,000 requests per second on a lightweight PC, but then again they could still be knocked offline from a super resourceful organization. I like not putting all my eggs in one bask
Read the rest
et. A similar bug could happen with something like Cloudflare- the computer serving up the firewall could have a bug, and it's not programmed to fall back on serving the site without the gatekeeping. If the site is prominent enough, it might routinely face DoS attacks which prevents it from being used. But if it's an uneventful day, it could still manage a lower-tech firewall and still be functional.
In Why older tech is sometimes safer from hackers
I'm almost ready to ship the wasm feature in the next version of Anubis after the one that's about to come out. The big blocker is that testing against dozens of googles chrome to ensure functionality on abandoned smart TV oses takes a nontrivial amount of time. As an example of the level of debugging and the like required: https://github.com/TecharoHQ/anubis/pull/1684/changes/67621f... My office gets very warm when chromesweep runs. This is something that is complicated enough that even though LLM tools can help, it's not a magic bullet. It's just complicated in general.
In A year of fighting scrapers on my 1.5 million-page website
The prompt used for Opus 4.8 was: write a implementation of the anubis proof of work in native c code, optimized for speed above all else. use every trick available to make the proof of work as efficient and fast as possible, including modern processor tricks on the x86 platform. your code should avoid using external libraries where possible, include tests, and be readable and concise. a reference for what needs to be met is in this repository. https://github.com/TecharoHQ/anubis Then let’s develop this more. turn this solver into a local HTTP server that can be given work in the request, and it returns solved work. make an end to end tester that sends test work to the solver and waits for a valid response. add support for solving with a GPU using cuda. Then it was done more or less, it happily made a local server that supports
Read the rest
solving the challenges given to it in bulk with priority based queue and can tolerate potentially tens of thousands of requests a second with no issue. The CPU time spent solving the challenges is less than the SSL setup for the connections. The GPU version does in excess of 20GH/s (but with high latency) though I didn't really test it, I'm not using this for anything but proving a point that the LLM itself can write the bypass tools and run them happily.
In 99% of My Website Traffic Is Bots
> that stupid anime girl who is on way too many open source web sites I assume you're referring to https://github.com/TecharoHQ/anubis. As I understand, this is a tool for blocking bot traffic and is sometimes used as DDOS protection. In my experience it's less obtrusive than Cloudflare, and it's open source and competes with Cloudflare's near monopoly on DDOS protection. I don't think we should be discouraging people from protecting their sites from unwanted traffic.
In Apple's hostile App Store rating system
I think you'd definitely find some interest, e.g. anyone that intentionally avoids "the cloud" will want something local. Honestly I assume there are some of these already, monitoring apache/nginx/etc logs. Anubis is arguably similar and has been exploding lately, for example, though I'm not sure if it auto-updates its rules at all: https://github.com/TecharoHQ/anubis As to if it'd get enough interest: yea no idea at all. I wish you luck tho! Clearly there's a need for this kind of thing.
In Cloudflare CEO is lying to you about the bot traffic jump

Showing the 15 most recent of 80 sources. Enable JavaScript to search and browse every indexed mention.

MAKE YOURSELF AT HOME

A few shortcuts

/
Search the collection
?
Open this guide
Esc
Close dialogs and navigation

Your saved repositories and interests stay in this browser.